Our Analysts Found the ‘.edu p1 35k’ Dump With 34,992 Student Logins

34,992 Student and Faculty Logins Found in the ".edu p1 35k" Dump

On July 19, 2026, HEROIC analysts discovered a combolist circulating in a private Telegram channel labeled ".edu p1 35k," specifically targeting email addresses from educational institutions. The file contained 34,992 records pairing .edu email addresses with plaintext passwords, along with URLs identifying the sites each credential was captured from.

Why This Combolist Is Dangerous

Because this list is filtered specifically to educational email addresses, it gives attackers a targeted starting point for phishing campaigns and account takeover attempts aimed at students, faculty, and school staff. With plaintext passwords included, there is no barrier between the leaked file and immediate misuse. An attacker can start testing logins the moment they get the file.

What Was Exposed in the ".edu p1 35k" Leak

• .edu email addresses
• Plaintext passwords
• URLs tied to each credential pair

Why This Matters for Students and School Staff

School accounts often connect to financial aid portals, email systems, and learning platforms, making them attractive targets. If you reuse a password across your school email and other accounts, this leak puts you at risk of credential stuffing, account takeover, and identity theft, especially since many students and staff reuse the same password across multiple services.

How Targeted Combolists Like This Are Built

Criminals build niche combolists by filtering larger stolen credential collections down to a specific domain type, such as .edu addresses, to sell to buyers who want to target a particular group. These filtered lists are traded and distributed in private Telegram channels, then used in automated login attempts against school portals and other services where the same login might have been reused.

Check If You Are Affected

If you have a .edu email address, HEROIC's free breach scanner can check it against a database of more than 400 billion exposed records to see if your credentials appear in this leak or any other breach. Run a scan now and update any reused passwords.